2 of 3 Easy DKIM SES TXT records where p tag has no value. "p="



I have set a SES identity configured with Easy DKIM (Easy DKIM is verified). When I resolve the automatically created amazonses TXT records, two of the three have a "p" tag that equals nothing.

For example, if I use the dig command dig example.dkim.amazonses.com TXT, The answer section I'm returned is example.dkim.amazonses.com. 2784 IN TXT "p="

I know two of the records are used for key rotation, but every other post about this I've seen says those records don't return any text, rather than the text "p=". Is this a problem?

Thanks for the help.

1 Answer
Accepted Answer

The "p=" with no value after the equals sign is actually a valid DKIM key record and it's not a problem. This is called a null DKIM record.

The three DKIM TXT records are for key rotation purposes - active, passive, and pending. AWS SES automatically rotates your DKIM keys every 90 days. The key rotation process involves a period where AWS publishes two active keys for your domain, the old one and the new one. After the new key propagates and AWS confirms its deployment, the old key becomes passive. After AWS confirms the passive key is no longer used for verification, AWS deletes the passive key and publishes a new pending key.

During the rotation process, one of these TXT records would be the active key and it would have a "p=" tag followed by the public key value. The other two TXT records, the passive key and the pending key, would have a "p=" tag with no value, which means these are null DKIM keys.

Null DKIM records are part of the DKIM standard and used to signify that a particular selector is not currently being used for signing. They are safe to ignore.

So what you're observing is expected behavior and you shouldn't be concerned about it. AWS SES is managing your DKIM keys and rotating them automatically.

Remember, however, to ensure that the "p=" tag with the public key value is indeed present in one of your three TXT records. If none of the records contain a value for the "p=" tag, then you have an issue and you might want to reach out to AWS support.

profile picture
answered 10 months ago
  • Thank you so much for the detailed explanation! I really appreciate it!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions